Large Scale Processing

TL;DR

While the rules vary from country to country, in general businesses should think of it as a sliding scale: The more sensitive the data and the more extensive the collection, the lower the numerical threshold.

For example, an eCommerce company based outside of Europe that collects fairly typical types of personal data (purchases, analytics data, etc.) probably isn't engaging in large scale processing unless it has a lot of customers in a particular country (as in, a measurable percentage of the total population of the country). On the other hand, an insurance company that collect an extensive amount of sensitive data from each person, the threshold is much lower, possibly as low as a few thousand people.

What Is Large Scale Processing?

Certain requirements in the GDPR are dependent on whether the data processing in question takes place on a “large scale.” 

What constitutes large-scale processing varies by jurisdiction. Some nations have used fixed figures or portions of the overall population as thresholds. For example, the Czech Republic has defined it as the processing of the data of 10,000 people or more, while Germany set a threshold of 5 million (or 40% of a relevant population). 

Other nations, such as Ireland and the UK, have a more subjective approach. In such jurisdictions, an organization should consider the following factors:

  • The number of individuals concerned;
  • The volume of data;
  • The variety of data;
  • The duration of the processing; and
  • The geographical extent of the processing.

Examples

Here are some examples of large scale processing according the UK:

  • A hospital (but not an individual doctor) processing patient data;
  • Tracking individuals using a city’s public transport system;
  • A fast food chain tracking real-time location of its customers;
  • An insurance company or bank processing customer data;
  • A search engine processing data for behavioral advertising; or
  • A telephone or internet service provider processing user data.


This content is provided for general informational purposes only and does not constitute legal advice. This content is not a substitute for obtaining legal advice from a licensed attorney. The information on this page may be changed without notice and is not guaranteed to be complete, correct or up-to-date, and may not reflect the most current legal developments.